diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e0aa06d..e91e7260 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,17 @@ Format: [Semantic Versioning](https://semver.org/). Spec versions follow `MAJOR.
 
 ## [Unreleased]
 
+- **Revocation store and `allow_embedded_key` are type-checked.** `verify_record` accepted
+  a dict or a string as `revocation`: a dict was searched by its field names, so a revoked
+  key verified, and a string was searched by substring. Both now raise
+  `ValueError`, as does a non-bool `allow_embedded_key`, which was read for truthiness (#511,
+  by @drk-ram).
+- **`verify_bridge` reports the real reason.** A key-id mismatch or an unusable trusted JWK
+  is now reported as itself rather than as an invalid signature; `verify_successor_artifact`
+  gets the same JWK check. Nothing that was rejected now passes (#510, by @drk-ram).
+- **Example: a valid signature is not verified execution.**
+  `examples/signature-execution-boundary/` shows a record of invented execution claims,
+  signed by the trusted issuer, passing `verify_record`, with 49 tests (#509, by @drk-ram).
 - **A second verifier, in TypeScript.** `trust-record-verify/` verifies TRACE v0.2 records
   independently of the Python implementation, and a differential harness scores the two
   against each other on 1644 cases: 1643 agree, and the remaining one is listed in the
diff --git a/examples/signature-execution-boundary/README.md b/examples/signature-execution-boundary/README.md
index f67cc5dd..9c63ba14 100644
--- a/examples/signature-execution-boundary/README.md
+++ b/examples/signature-execution-boundary/README.md
@@ -6,7 +6,7 @@ An executable, synthetic example building on the [quickstart](../../docs/quickst
 cryptographic signature validity and verified execution in TRACE v0.2 without changing
 the specification, schema, or SDK behavior.
 
-## Reproduce at pinned commit `c08974c3c0b33d9bd77bc1778b238a86f770b788`
+## Reproduce at pinned commit `66665745bb7d334d9805abefad77ed35898fad55`
 
 Install the repository's development dependencies and run from the repository root: